I exidetaly DELTED all personal files on my system, linux pop os pls help!

[Luka95]

I wanted to remove sysmontask app completly, i previously installed it from source, and i typed something like this: $ find -sysmontask 'sysmontask*' -exec rm {} \;

But it deleted all the friking files from my system!!! I have important files for work, and a lot of pictures that are wery old, pictures i had on second drive but recently i deleted that backup to temporeraly use it as second system drive and just in that period i deleted all the files on main system and now i have nothing!!!

But first i would like to recover jsut couple of MB txt files that i have in my documents folder, that is most important since its for work. And the pictures i could live without..

Looks like encrition is making a problem, if i just scan the drive it cant read it because drive is encrypted, i know the password but i dont get the chance to unlock it. How to first unlock the drive and than scan it?  Tnx in advanced!

[Needfuldoer]

F

 

Try using a utility like PhotoRec to recover them to an external drive. (Do not write to the drive you're trying to recover the files from!) I'd even recommend buying a new external drive in case you can recover anything off your existing backup drive.

 

Going forward, never delete backups! Always have at least three copies of files you care about!

[Bismut]

Big F

 

I assume that your OS drive is still fine? If so, try using testdisk and restore files that way. Always back up things that are really important/irreplacable, see 3-2-1 backup strategy.

[Biohazard777]

1 minute ago, Needfuldoer said:

(Do not write to the drive you're trying to recover the files from!) I'd even recommend buying a new external drive in case you can recover anything off your existing backup drive.

Yep.

@Luka95 Do not even mount it as a regular drive, mount it as read only. If that drive was boot drive, then don't boot from it, use a live linux usb instead.
Also, you shouldn't try recovering directly from the drive... instead you should make an image of the drive (using dd for example) and then try recovering files from that.

 

PS PhotoRec won't recover file names... Hopefully you will manage to recover files, but then you will have to manually rename them...

 

 

[Luka95]

5 minutes ago, Bismut said:

Big F

 

I assume that your OS drive is still fine? If so, try using testdisk and restore files that way. Always back up things that are really important/irreplacable, see 3-2-1 backup strategy.

yes os works normaly exsept there is no single personal file in it, am trying to use that toll but am not getting it right. Idk what partition to select and when i select the only one that have opcion "undelete" i get error "Support for this filesystem wasn't enabled during compilation."

[Roswell]

If it's an SSD and it was mounted or booted in a normal fashion afterwards, there's a 99.999% chance that everything is gone due to TRIM and garbage collection.

 

Always make sure you have a local and online backup of important files. 

[Jira Rudolfirina Bills]

You can use forensic tools from Kali Linux to possibly recover files. Before I knew completely better, I bought a Windows utility that would recover files I think from proprietary systems. I suggest starting with installing a live DVD or pen drive version of Kali Linux, looking through your system's internal hard drive devices' file systems and use a tool for file recovery. I tried looking up what tool would be useful for you, but I usually don't have these problems, so you will have to look through the Kali CLI utilities and type man 'utility' replacing 'utility' with the tool you're going to use in the terminal to get an explanation of what it does and what you should be looking for. You should look for something with regards to 'file recovery'.